d28c2fa96a805366ca56a9e2e5610acebc45f901ffe9b9e92c9d00283ba056b7

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2023, 01:59

Target

RunDLL-1.bat
Size

17B
MD5

73cd9d0f9846c1d36ea4381bc13e5db6
SHA1

9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d
SHA256

ae525af92190baa36d5644a232e940f0b7d855802617435832fe474b6248b0ec
SHA512

4724a04222218efa1d2e5b669810a1769ded561b87f87a73b03a412be392966fc1d0febc0f9dc693dba2f294f72a8bda83bdb0303ccc50a4f1367afa1ba2b693

Score

1^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1244	rdpclip.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1244	rdpclip.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	RuntimeBroker.exe
Token: SeDebugPrivilege	1244	rdpclip.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2004	1508	cmd.exe	82
PID 1508 wrote to memory of 2004	1508	cmd.exe	82
PID 2004 wrote to memory of 1244	2004	RuntimeBroker.exe	83
PID 2004 wrote to memory of 1244	2004	RuntimeBroker.exe	83
PID 2004 wrote to memory of 1244	2004	RuntimeBroker.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RunDLL-1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
  RuntimeBroker.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\System32\rdpclip.exe
    "C:\Windows\System32\rdpclip.exe"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1244

memory/1244-152-0x0000023346C50000-0x0000023346C60000-memory.dmp

Filesize
64KB

Download
memory/1244-142-0x0000000180000000-0x0000000180029000-memory.dmp

Filesize
164KB

Download
memory/1244-155-0x0000023346C50000-0x0000023346C60000-memory.dmp

Filesize
64KB

Download
memory/1244-137-0x0000023344B80000-0x0000023344BA5000-memory.dmp

Filesize
148KB

Download
memory/1244-154-0x00007FF9A8500000-0x00007FF9A8FC1000-memory.dmp

Filesize
10.8MB

Download
memory/1244-153-0x0000023346C50000-0x0000023346C60000-memory.dmp

Filesize
64KB

Download
memory/1244-151-0x00007FF9A8500000-0x00007FF9A8FC1000-memory.dmp

Filesize
10.8MB

Download
memory/1244-150-0x0000000180000000-0x0000000180029000-memory.dmp

Filesize
164KB

Download
memory/2004-136-0x0000028B4CDE0000-0x0000028B4CDE1000-memory.dmp

Filesize
4KB

Download
memory/2004-140-0x0000028B66E70000-0x0000028B66E71000-memory.dmp

Filesize
4KB

Download
memory/2004-145-0x00007FF9A8500000-0x00007FF9A8FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2004-134-0x0000028B4CDD0000-0x0000028B4CDD1000-memory.dmp

Filesize
4KB

Download
memory/2004-133-0x0000028B4CDC0000-0x0000028B4CDC1000-memory.dmp

Filesize
4KB

Download
memory/2004-138-0x0000028B4CDF0000-0x0000028B4CDF1000-memory.dmp

Filesize
4KB

Download
memory/2004-139-0x0000028B66E60000-0x0000028B66E61000-memory.dmp

Filesize
4KB

Download
memory/2004-135-0x00007FF9A8500000-0x00007FF9A8FC1000-memory.dmp

Filesize
10.8MB

Download